Your achievements

Level 1

0% to

Level 2

Tip /
Sign in

Sign in to Community

to gain points, level up, and earn exciting badges like the new
BedrockMission!

Learn more

View all

Sign in to view all badges

SOLVED

Initiate SAML logout request at IDP on session timeout on AEM.

eshan_fiction
Level 1
Level 1

Hi

I have to logout a user from both AEM application and SAML identity provider after session timeout on AEM. I am using "Apache Jackrabbit Oak TokenConfiguration" to set the time for session time out. But after the session time out occurs at AEM the login request is being initiated from AEM instead of logout request.

How do I achieve this?

1 Accepted Solution
kautuk_sahni
Correct answer by
Community Manager
Community Manager

Did you check this post :- Re: AEM SAML integration - logout doesn't go to IDP logout URL ?

What happens here is that when the logout happens if we configure root path ("/") it works because the /system/sling/logout servlet redirects the response to "/" after logout, which is then handled by the SAML Auth Handler.

However when the SAML Auth Handler is not configured with "/", then it will no longer get invoked because the /system/sling/logout servlet still redirects the response to "/" and SAML is not invoked.

Solution :- AuthUtil.setLoginResourceAttribute(request, "/path-configured-in-saml-config").

OR

Create an overlay for the JSP at :

/libs/cq/core/components/login/logout.jsp

In this JSP change the line below:

window.location.href = "<%= request.getContextPath() %>/system/sling/logout.html;

to

window.location.href = "<%= request.getContextPath() %>/system/sling/logout.html?resource=<the path you configured in the SAML config handler>";

This should convince the method at : https://svn.apache.org/repos/asf/sling/tags/org.apache.sling.auth.core-1.0.6/src/main/java/org/apach..., to set the resource path instead of setting the value to "/"

// find the redirect target from the resource attribute or parameter

// falling back to the reuest context path (or /) if not set

String target = AbstractAuthenticationHandler.getLoginResource(request,

request.getContextPath());

if (target.length() == 0) {

target = "/";

}

~kautuk

View solution in original post

5 Replies
kautuk_sahni
Correct answer by
Community Manager
Community Manager

Did you check this post :- Re: AEM SAML integration - logout doesn't go to IDP logout URL ?

What happens here is that when the logout happens if we configure root path ("/") it works because the /system/sling/logout servlet redirects the response to "/" after logout, which is then handled by the SAML Auth Handler.

However when the SAML Auth Handler is not configured with "/", then it will no longer get invoked because the /system/sling/logout servlet still redirects the response to "/" and SAML is not invoked.

Solution :- AuthUtil.setLoginResourceAttribute(request, "/path-configured-in-saml-config").

OR

Create an overlay for the JSP at :

/libs/cq/core/components/login/logout.jsp

In this JSP change the line below:

window.location.href = "<%= request.getContextPath() %>/system/sling/logout.html;

to

window.location.href = "<%= request.getContextPath() %>/system/sling/logout.html?resource=<the path you configured in the SAML config handler>";

This should convince the method at : https://svn.apache.org/repos/asf/sling/tags/org.apache.sling.auth.core-1.0.6/src/main/java/org/apach..., to set the resource path instead of setting the value to "/"

// find the redirect target from the resource attribute or parameter

// falling back to the reuest context path (or /) if not set

String target = AbstractAuthenticationHandler.getLoginResource(request,

request.getContextPath());

if (target.length() == 0) {

target = "/";

}

~kautuk

View solution in original post

ankitg2807
Level 2
Level 2

HI ,

I have configured logout on aem and it is successfully logging out user from aem & Okta , but after logout on Okta, okta submits a SAML Logout response to SingleLogoutService .

This service URL I gave as /content/test/utils/secure/saml_logout , but when response is posted to this endpoint from okta,  it get 500 errror in AEM as below -

 

org.apache.sling.api.resource.PersistenceException: Resource at '/content/test/utils/secure/saml_logout' is not modifiable

Please can you let me know what should be the SingleLogoutService url in AEM to receive OKTA logout response ?

 

Thanks!

eshan_fiction
Level 1
Level 1

Thanks for your response Kautuk, appreciate your help.

pradeepn6086740
Level 2
Level 2

Hi kautuk sahni

I am trying to setup SAML config on AEM 6.4 SP2 instance and logout functionality is not working for us. Can you please help me with the changes that needs to be done to make it work.

I am not able to find "/libs/cq/core/components/login/logout.jsp" in AEM 6.4 instance.

Thanks,

Pradeep

ankitg2807
Level 2
Level 2

HI ,

I have configured logout on aem and it is successfully logging out user from aem & Okta , but after logout on Okta, okta submits a SAML Logout response to SingleLogoutService .

This service URL I gave as /content/test/utils/secure/saml_logout , but when response is posted to this endpoint from okta,  it get 500 errror in AEM as below -

 

org.apache.sling.api.resource.PersistenceException: Resource at '/content/test/utils/secure/saml_logout' is not modifiable

Please can you let me know what should be the SingleLogoutService url in AEM to receive OKTA logout response ?

 

Thanks!